friend clicked link in email that was obviously a paypall scam
he was connected to someone who started trying to mirror his ipad
he figured it out and immediately turned off that device, went to another device and changed password.
What else should he do